Vulnerability Description
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Object-Path Project | Object-Path | < 0.11.6 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/mariocasciaro/object-path%230116Broken Link
- https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e899PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423ExploitThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453ExploitThird Party Advisory
- https://github.com/mariocasciaro/object-path%230116Broken Link
- https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e899PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423ExploitThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453ExploitThird Party Advisory
FAQ
What is CVE-2021-23434?
CVE-2021-23434 is a vulnerability with a CVSS score of 5.6 (MEDIUM). This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular,...
How severe is CVE-2021-23434?
CVE-2021-23434 has been rated MEDIUM with a CVSS base score of 5.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23434?
Check the references section above for vendor advisories and patch information. Affected products include: Object-Path Project Object-Path, Debian Debian Linux.